Overview

overview

10

Static

static

10

661f38db3c...cs.exe

windows7-x64

10

661f38db3c...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    661f38db3ce3a007a1e98d8b2d3ddc20_NeikiAnalytics.exe

  • Size

    89KB

  • Sample

    240523-a7x3lsfd5z

  • MD5

    661f38db3ce3a007a1e98d8b2d3ddc20

  • SHA1

    2ce0c613155e952c755d1fa9f1fe2b179396957b

  • SHA256

    b5cfbb6f750eb9d626fec91f03e3caa6af87b15149b7690a0205a4985ab19d9a

  • SHA512

    f8ad3f5329e90b83adc82731192402aebc70347de9aa350df937432af4b98fdd2b7e9de1d651583553c11e9b5bdd3c7738d5f1b902740aa3cd5c0574eecfdfee

  • SSDEEP

    1536:7J1VXkXrPLSjJwCKOQATF3xuPF88RQbD68a+VMKKTRVGFtUhQfR1WRaROR8R:7J1xk7PLwKCKOzTruPC8eqr4MKy3G7Ug

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      661f38db3ce3a007a1e98d8b2d3ddc20_NeikiAnalytics.exe

    • Size

      89KB

    • MD5

      661f38db3ce3a007a1e98d8b2d3ddc20

    • SHA1

      2ce0c613155e952c755d1fa9f1fe2b179396957b

    • SHA256

      b5cfbb6f750eb9d626fec91f03e3caa6af87b15149b7690a0205a4985ab19d9a

    • SHA512

      f8ad3f5329e90b83adc82731192402aebc70347de9aa350df937432af4b98fdd2b7e9de1d651583553c11e9b5bdd3c7738d5f1b902740aa3cd5c0574eecfdfee

    • SSDEEP

      1536:7J1VXkXrPLSjJwCKOQATF3xuPF88RQbD68a+VMKKTRVGFtUhQfR1WRaROR8R:7J1xk7PLwKCKOzTruPC8eqr4MKy3G7Ug

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks